Although the master has overall command of a vessel, a basic premise of modern safety management is that shore management has the ultimate responsibility for setting policies, procedures, and operating instructions for the safe operation of the entire enterprise. The introduction of a safety management system requires that a company develop and implement safety management procedures to ensure that conditions and activities, both ashore and afloat, affecting safety and environmental protection are planned, executed and checked in accordance with regulatory and company requirements. A structured system also enables the company to focus on the enhancement of safe ship operations and on preparing for emergencies. Companies that are successful in establishing a safety management system may expect to see a reduction in accidents. The safety philosophy behind the HSC Code is based, inter alia, on the management and reduction of risk through quality management, and goes on to state that the management of the company operating the craft exercises strict control over its operation and maintenance by a quality management system.6 The HSCCode, however, does not apply to high speed vessels operating within the Great Lakes. For the SeaflightI, the establishment of a company quality management system incorporating formal approved procedures, in particular for voyage planning, might have provided better guidance to the vessel's crew when conducting the vessel within the confined waters of the Niagara River. The design of the electronic steering control system limits the rudder angle to 10degrees; however, at the time of the occurrence, the rudder moved hard to port (32degrees). This indicates that the electronic control was not functioning correctly at the time. The uncommanded rudder movement is more indicative of the self-test function, which puts the rudder hard over to port or starboard following a power interruption to the electronic steering system. Because the electronic steering control system is not equipped with an alarm warning of power failure, the bridge crew would not have been aware that an interruption to the control system power supply had occurred until they moved the wheel or when the power supply was re-established and the rudder moved uncommanded. Subsequent to the occurrence, the electronic control system remained unserviceable and, as a result, the electric-hydraulic control system was used during the return trip to Toronto. The fact that the steering solenoid valves (which are the common factor between the two control systems) were functioning properly is a further indication that the steering malfunction occurred within the electronic control system. The DSC Code states that the administration should determine by demonstration any adverse effects upon safe operation of the craft in the event of uncontrollable total deflection of any one steering device. The electronic steering system on board the SeaflightI is a complex control system that integrates information from the vessel's log and stabilizer system to limit the vessel's rudder movement to design limits. A more detailed examination of the electronic steering control characteristics (as they relate to vessel manoeuverability) at the time the vessel was inspected, would have revealed the undesirable self-test inherent in the electronic steering control system, and elicited a better understanding of the vessel's limits by TCMS. Despite numerous complaints from residents and warnings from the USCG, the SeaflightI routinely passed within 23m of the mooring area. Prudence would dictate that an adequate distance be maintained from possible hazards to navigation; however, at the time of the occurrence, the SeaflightI was approximately 60m from the moored yachts. the vessel's stopping distance of 335m at 33kn (17m/sec); the time required for the crew to recognize the failure and change steering control modes; and the rudder response time (five seconds for the rudder to go from hard-over to midships using the electric steering control); the proximity of the moored yachts was such that the SeaflightI could not have avoided striking them once the rudder had moved, uncommanded, hard to port. The Niagara River is 550m wide at Youngstown, New York; however, with the mooring area of the YYC taken into account, the usable width of the river is 365m. Given the vessel's required stopping distance of 335m, the river is not wide enough to allow the vessel safe passage at 33kn in the foil-borne mode. A voyage route operational manual, similar to those required on other HSC, could have required the vessel to follow a course closer to the middle of the Niagara River, in displacement mode, giving the crew more time to regain steering control or stop the vessel.Analysis Although the master has overall command of a vessel, a basic premise of modern safety management is that shore management has the ultimate responsibility for setting policies, procedures, and operating instructions for the safe operation of the entire enterprise. The introduction of a safety management system requires that a company develop and implement safety management procedures to ensure that conditions and activities, both ashore and afloat, affecting safety and environmental protection are planned, executed and checked in accordance with regulatory and company requirements. A structured system also enables the company to focus on the enhancement of safe ship operations and on preparing for emergencies. Companies that are successful in establishing a safety management system may expect to see a reduction in accidents. The safety philosophy behind the HSC Code is based, inter alia, on the management and reduction of risk through quality management, and goes on to state that the management of the company operating the craft exercises strict control over its operation and maintenance by a quality management system.6 The HSCCode, however, does not apply to high speed vessels operating within the Great Lakes. For the SeaflightI, the establishment of a company quality management system incorporating formal approved procedures, in particular for voyage planning, might have provided better guidance to the vessel's crew when conducting the vessel within the confined waters of the Niagara River. The design of the electronic steering control system limits the rudder angle to 10degrees; however, at the time of the occurrence, the rudder moved hard to port (32degrees). This indicates that the electronic control was not functioning correctly at the time. The uncommanded rudder movement is more indicative of the self-test function, which puts the rudder hard over to port or starboard following a power interruption to the electronic steering system. Because the electronic steering control system is not equipped with an alarm warning of power failure, the bridge crew would not have been aware that an interruption to the control system power supply had occurred until they moved the wheel or when the power supply was re-established and the rudder moved uncommanded. Subsequent to the occurrence, the electronic control system remained unserviceable and, as a result, the electric-hydraulic control system was used during the return trip to Toronto. The fact that the steering solenoid valves (which are the common factor between the two control systems) were functioning properly is a further indication that the steering malfunction occurred within the electronic control system. The DSC Code states that the administration should determine by demonstration any adverse effects upon safe operation of the craft in the event of uncontrollable total deflection of any one steering device. The electronic steering system on board the SeaflightI is a complex control system that integrates information from the vessel's log and stabilizer system to limit the vessel's rudder movement to design limits. A more detailed examination of the electronic steering control characteristics (as they relate to vessel manoeuverability) at the time the vessel was inspected, would have revealed the undesirable self-test inherent in the electronic steering control system, and elicited a better understanding of the vessel's limits by TCMS. Despite numerous complaints from residents and warnings from the USCG, the SeaflightI routinely passed within 23m of the mooring area. Prudence would dictate that an adequate distance be maintained from possible hazards to navigation; however, at the time of the occurrence, the SeaflightI was approximately 60m from the moored yachts. the vessel's stopping distance of 335m at 33kn (17m/sec); the time required for the crew to recognize the failure and change steering control modes; and the rudder response time (five seconds for the rudder to go from hard-over to midships using the electric steering control); the proximity of the moored yachts was such that the SeaflightI could not have avoided striking them once the rudder had moved, uncommanded, hard to port. The Niagara River is 550m wide at Youngstown, New York; however, with the mooring area of the YYC taken into account, the usable width of the river is 365m. Given the vessel's required stopping distance of 335m, the river is not wide enough to allow the vessel safe passage at 33kn in the foil-borne mode. A voyage route operational manual, similar to those required on other HSC, could have required the vessel to follow a course closer to the middle of the Niagara River, in displacement mode, giving the crew more time to regain steering control or stop the vessel. Because theSeaflightI operated within the Great Lakes, it was inspected under the provisions of the DSCCode and, as a result, there was no requirement for the company and vessel to have a safety management system. No fixed voyage speeds or routes were required for the vessel as a condition of her certification. Before the occurrence, the SeaflightI routinely passed close to the mooring area of the Youngstown Yacht Club. The SeaflightI was upbound in the Niagara River in foil-borne mode travelling at 33kn, approximately 60m from the mooring area at the time of the occurrence. Travelling at 33kn, the SeaflightI has a stopping distance of approximately 335m. The action of the master of the SeaflightI to avoid a yacht with six people on board mitigated the consequences of the occurrence and prevented injuries. Following the occurrence, the main electronic steering control system was found to be functioning erratically; however, the backup electric steering control was working properly. The service manual for the electronic control system clearly lists several failure modes which could cause the rudder to move uncommanded to port. When power is restored to the electronic steering control system following a power interruption of more than one second, the rudder will move, uncommanded, 10degrees to port or starboard. No alarms are fitted to indicate a power failure to the electronic-hydraulic steering control system. The Niagara River at Youngstown, New York, is not wide enough to allow safe passage of the SeaflightI in the foil-borne mode.Findings Because theSeaflightI operated within the Great Lakes, it was inspected under the provisions of the DSCCode and, as a result, there was no requirement for the company and vessel to have a safety management system. No fixed voyage speeds or routes were required for the vessel as a condition of her certification. Before the occurrence, the SeaflightI routinely passed close to the mooring area of the Youngstown Yacht Club. The SeaflightI was upbound in the Niagara River in foil-borne mode travelling at 33kn, approximately 60m from the mooring area at the time of the occurrence. Travelling at 33kn, the SeaflightI has a stopping distance of approximately 335m. The action of the master of the SeaflightI to avoid a yacht with six people on board mitigated the consequences of the occurrence and prevented injuries. Following the occurrence, the main electronic steering control system was found to be functioning erratically; however, the backup electric steering control was working properly. The service manual for the electronic control system clearly lists several failure modes which could cause the rudder to move uncommanded to port. When power is restored to the electronic steering control system following a power interruption of more than one second, the rudder will move, uncommanded, 10degrees to port or starboard. No alarms are fitted to indicate a power failure to the electronic-hydraulic steering control system. The Niagara River at Youngstown, New York, is not wide enough to allow safe passage of the SeaflightI in the foil-borne mode. The SeaflightI lost steering and struck four moored yachts as a result of a failure of her electronic steering control system. Contributing to the occurrence was the vessel's high speed in relatively confined waters, and her close passage to the mooring area.Causes and Contributing Factors The SeaflightI lost steering and struck four moored yachts as a result of a failure of her electronic steering control system. Contributing to the occurrence was the vessel's high speed in relatively confined waters, and her close passage to the mooring area. Safety Action